blocking: x encrypted partition for keys x second tor service for SSH access - confirm that .onion wildcard will work for both *.HASH.onion and *.us.HASH.onion - (optional) mine a new 'archive...' v3 onion - acquire EV cert not blocking: - disable NTP listening ports - CORS issue with bookreader? didn't exist before - battery UPS? if available - some kind of monitoring/alerting